Information Assurance

PROGRAM WORK STATEMENT (PWS) SECURITY LANGUAGE

5.0 SECURITY

5.1 Handling of Non-Public Information

5.2 Requirements for Contractor Provision of Security Plan and Information Assurance Controls

5.3 Periodic Government Inspections

5.4 Remote Access

5.5 Detect, Analyze, Respond

5.5.1 Reporting Requirements

5.5.2 Incident Report Content

5.5.3 Incident Report Submission

5.5.4 Incident Response Coordination

5.6 Law Enforcement/Counterintelligence

5.7 Information Sharing

5.8 Confidentiality and Non-Attribution Statement

5.9 Information Assurance Training

5.10 Information Assurance Workforce Improvement Program

5.1 Handling of Non-Public Information

In performance of this contract, the Contractor may have access to sensitive, non-public information. The Contractor agrees (a) to use and protect such information from unauthorized disclosure in accordance with DTM 08-027 - Security of Unclassified DOD Information on Non-DOD Information Systems, 31 July 2009; (b) to use and disclose such information only for the purpose of performing this contract and to not use or disclose such information for any personal or commercial purpose; (c) to obtain permission of the Government PM before disclosing/discussing such information with a third party; (d) to return and/or electronically purge, upon Government request, any non-public, sensitive information no longer require for Contractor performance; and (e) to advise the Government PM of any unauthorized release of such information. Upon request, the Contractor shall have its employees assigned to this contract execute a non-disclosure agreement for delivery to the Government. The Government will require Contractor personnel to sign a non-disclosure statement to protect non-public information of other Contractors and/or the Government.

5.2 Requirements for Contractor Provision of Security Plan and Information Assurance (IA) Controls

The Contractor shall establish an IA Program to implement and sustain appropriate IA management, operational, and technical controls and processes required to safeguard DOD non-public information resident on or transiting the Contractor's unclassified information systems from unauthorized access and disclosure. Protection measures applied must be commensurate with the risks (i.e. consequences and their probability) of loss, misuse, unauthorized access, or modification of information. The Contractor shall submit for Government approval an overarching security plan that describes their strategy for implementation of IA and Industrial Security requirements throughout the life of the contract. The security plan shall address the security controls described in NIST Special Publication 800-53 (current version), Recommended Security Controls for Federal Information Systems and Organizations (http://csrc.mist.gov/publications/PubsSPs.html), and should be tailored in scope and depth appropriate to the effort and the specific unclassified DOD information.

5.3 Periodic Government Inspections

The Contractor shall authorize periodic Government inspections and reviews to assure compliance with DOD IA requirements throughout the contract performance period. The Contractor will be responsible for taking corrective action based upon the impact and severity of identified weaknesses.

5.5 Detect, Analyze, Respond

5.5.1 Reporting Requirements

Definition of advanced persistent threat: An extremely proficient, patient, determined, and capable adversary, including two or more of such adversaries working together.

5.5.2 Incident Report Content

5.5.3 Incident Report Submission

The Contractor will submit unclassified network cyber incident reports to the USTRANSCOM Technical Information Analysis Center (TIAC) and USTRANSCOM designated government personnel via encrypted email or another mutually agreed upon secure communications method. Copies of malware require special handling and pre-coordination must be accomplished prior to submission.

5.5.4 Incident Response Coordination

In the event of a known or potential intrusion, the Contractor agrees to allow follow-on actions by the Government to further characterize and evaluate the suspect activity. The Contractor acknowledges that damage assessments may be necessary to ascertain intruder methodology and identify systems compromised as a result of the intrusion. Company acknowledges that in certain cases a complete forensic analysis may be necessary to ascertain intruder methodology and identify systems compromised as a result of the intrusion. Company acknowledges that once unauthorized access is identified, destruction of evidence related to the suspect activity could constitute obstruction of a criminal investigation in violation of 18 U.S.C. § 1510. Any follow-on actions will be coordinated with the Contractor via the Contracting Officer's Technical Representative (COTR).

5.6 Law Enforcement/Counterintelligence

In the event of a known or potential intrusion, the Contractor shall consent to responding counterintelligence or law enforcement investigative agency requests to apply forensic analysis tools to Contractor information systems affected by the intrusion, including monitoring tools, imaging tools, and any other techniques that the agency seeks to apply to effectively analyze the intrusion. Contractor shall allow the responding counterintelligence or law enforcement investigative to image affected systems, including systems containing proprietary information. Nothing in this contract shall limit the ability to conduct law enforcement or counterintelligence activities, or other activities in the interest of national security.

5.7 Information Sharing

The Government may use and disclose reported information that does not include attribution information (e.g., information regarding threats, vulnerabilities, incidents, or best practices) at its discretion to assist entities in protecting information or information systems (e.g. threat information products, threat assessment reports); provided that such use or disclosure is otherwise authorized in accordance with applicable statutes, regulations, and policies.

5.8 Confidentiality and Non-Attribution Statement

The Government shall take reasonable steps, by controlled access and need-to-know procedures, to protect against public release of attribution information of the Contractor. The government may use and disclose reported information that includes attribution information only on a need-to-know basis to authorized persons for cyber security and related purposes (e.g., in support of forensic analysis, incident response, compromise or damage assessments, law enforcement, counter intelligence, threat reporting, trend analysis). The Government may disclose attribution information to support Contractors that are supporting the Government's cyber security and related activities if the support Contractor is subject to legal confidentiality requirements that prevent any further use or disclose of the attribution information. The Government agrees to make full use of the exemptions of the Freedom of Information Act to protect against disclosure of attribution information of the Contractor to unauthorized persons. Within a reasonable period necessary to perform an analysis after completion of the assessment, all Contractor proprietary information or third party proprietary information in the possession of the Government as a result of the assessment will be destroyed unless other disposition is agreed upon in writing by the Parties or is required by law, Executive Order or regulation.

5.9 Information Assurance Training

Contract employees physically assigned to USTRANSCOM/TCCs at SAFB shall attend/complete security training as prescribed by DOD and USTRANSCOM/TCC instructions. At a minimum this includes: Employee Initial Security Training, Annual Security Awareness Training, Operations Security (OPSEC), DOD Antiterrorism Level 1 Training, Personally Identifiable Information (PII) Training and any Security Stand-Down Day Training scheduled by the Commander. Contract employees assigned elsewhere shall attend security training established by their respective government security offices and/or installations.

5.10 Information Assurance Workforce Improvement Program (IAWIP)